CAPTCHA / challenge · Intuition Machines
hCaptcha
Difficulty 3/5
The privacy-positioned reCAPTCHA alternative, and Cloudflare’s former challenge provider. Difficulty scales with how suspicious you already look.
- TLS fingerprinting
- JS challenge required
- Behavioural scoring
- IP reputation weight: high
How it decides
-
Image-labelling challenges whose difficulty is set by a risk score.
-
Device and address reputation decide whether you get a silent pass or nine tiles of buses.
-
Issues a token the site verifies server-side.
What you see when it stops you
- `hcaptcha.com/1/api.js` in the page
- An `h-captcha` element
- Escalating challenge difficulty on retry
Signatures the detector matches
Publicly observable artefacts hCaptcha sends to every visitor. Paste a response into the analyser and these are what it looks for.
| Where | Signal | Weight |
|---|---|---|
| Page markup | hCaptcha script | 70 |
| Page markup | hCaptcha widget | 55 |
What actually gets through
-
Residential exits keep the difficulty low; datacenter addresses get the hardest variant every time.
-
A consistent browser profile — the score is per-device as much as per-address.
Not sure this is what
is blocking you?
Paste the response you actually got. The detector names the vendor from its own headers, cookies and challenge markup — no account, nothing uploaded.